high-throughput secure three-party computation for ... · high-throughput secure three-party...
TRANSCRIPT
High-Throughput Secure Three-Party Computation for Malicious
Adversaries and an Honest Majority
Jun Furukawa*, Yehuda Lindell**, Ariel Nof** and Or Weinstein**
**Bar-Ilan University, Israel*NEC corporation, Israel
Eurocrypt 2017
Secure Three-Party Computation with an Honest Majority
𝑓(𝑥1, 𝑥2, 𝑥3)
𝑥1 𝑥2
𝑥3
Secure Three-Party Computation with an Honest Majority
𝑓(𝑥1, 𝑥2, 𝑥3)
𝑥1 𝑥2
𝑥3
Secure Three-Party Computation with an Honest Majority
𝑓(𝑥1, 𝑥2, 𝑥3)
𝑥1 𝑥2
𝑥3• Functionality is represented
by a Boolean circuit• Security with abort
High-Throughput Secure Three-Party Computation with an Honest Majority
High-Throughput Secure Three-Party Computation with an Honest Majority
f𝑡𝑠𝑡𝑎𝑟𝑡 𝑡𝑒𝑛𝑑
How much time it takes to compute a function?
High-Throughput Secure Three-Party Computation with an Honest Majority
Latency
f𝑡𝑠𝑡𝑎𝑟𝑡 𝑡𝑒𝑛𝑑
How much time it takes to compute a function?
High-Throughput Secure Three-Party Computation with an Honest Majority
Latency
f𝑡𝑠𝑡𝑎𝑟𝑡 𝑡𝑒𝑛𝑑
How much time it takes to compute a function?
f
1 𝑠𝑒𝑐
ff
ff
ff
ff
How many functions can we compute in one sec?
High-Throughput Secure Three-Party Computation with an Honest Majority
Latency Throughput
f𝑡𝑠𝑡𝑎𝑟𝑡 𝑡𝑒𝑛𝑑
How much time it takes to compute a function?
f
1 𝑠𝑒𝑐
ff
ff
ff
ff
How many functions can we compute in one sec?
Low Latency VS. High-Throughput
High-ThroughputLow Latency
Low Latency VS. High-Throughput
High-ThroughputLow Latency
• Constant rounds of communication
𝑃1
𝑃2
“the garbled-circuit approach”
Low Latency VS. High-Throughput
High-Throughput
• Low bandwidth• Simple Computations
Low Latency
• Constant rounds of communication
𝑃1
𝑃2
𝑃1
𝑃2
“the garbled-circuit approach” “the secret-sharing approach”
Low Latency VS. High-Throughput
High-Throughput
• Low bandwidth• Simple Computations
Low Latency
• Constant rounds of communication
𝑃1
𝑃2
𝑃1
𝑃2
“the garbled-circuit approach” “the secret-sharing approach”
The Starting Point: The Semi-honest protocol of [AFLNO16]
•Based on replicated secret sharing
•Requires 1 bit of communication sent by each party per AND gate.
• Speed: compute over 7 billion AND gates per second• Concretely, over 1,300,000 AES operations per second
From Semi-Honest to Malicious adversary
• Sharing the inputs
• Emulating the circuit
• Output Reconstruction
From Semi-Honest to Malicious adversary
• Sharing the inputs
• Emulating the circuit
• Output Reconstruction
How to force the corrupted party to share its inputs “correctly”?
How to verify AND gates were computed correctly?
How to verify that the output was reconstructed correctly?
From Semi-Honest to Malicious adversary
• Sharing the inputs
• Emulating the circuit
• Output Reconstruction
How to force the corrupted party to share its inputs “correctly”?
How to verify AND gates were computed correctly?
How to verify that the output was reconstructed correctly?
Verification of AND Gates
A “multiplication triple” is a triple of shares 𝑎 , 𝑏 , 𝑐 such that 𝑐 = 𝑎 ⋅ 𝑏
Verification of AND Gates
A “multiplication triple” is a triple of shares 𝑎 , 𝑏 , 𝑐 such that 𝑐 = 𝑎 ⋅ 𝑏
Let 𝑥 , 𝑦 , 𝑧 be a triple generated by computing an AND gate
Let 𝑎 , 𝑏 , 𝑐 be a random triple
Verification of AND Gates
A “multiplication triple” is a triple of shares 𝑎 , 𝑏 , 𝑐 such that 𝑐 = 𝑎 ⋅ 𝑏
Let 𝑥 , 𝑦 , 𝑧 be a triple generated by computing an AND gate
Let 𝑎 , 𝑏 , 𝑐 be a random triple
Verification of AND Gates
A “multiplication triple” is a triple of shares 𝑎 , 𝑏 , 𝑐 such that 𝑐 = 𝑎 ⋅ 𝑏
Let 𝑥 , 𝑦 , 𝑧 be a triple generated by computing an AND gate
Let 𝑎 , 𝑏 , 𝑐 be a random triple
If 𝑎 , 𝑏 , 𝑐 is a “valid” triple, then we
can use 𝑎 , 𝑏 , 𝑐 to detect cheating
in 𝑥 , 𝑦 , 𝑧 with probability 1.
Verification of AND Gates
A “multiplication triple” is a triple of shares 𝑎 , 𝑏 , 𝑐 such that 𝑐 = 𝑎 ⋅ 𝑏
Let 𝑥 , 𝑦 , 𝑧 be a triple generated by computing an AND gate
Let 𝑎 , 𝑏 , 𝑐 be a random triple
If 𝑎 , 𝑏 , 𝑐 is a “valid” triple, then we
can use 𝑎 , 𝑏 , 𝑐 to detect cheating
in 𝑥 , 𝑦 , 𝑧 with probability 1.
Sub-protocol “triple verification without opening”
Communication: 2 bits per each party
The Protocol
On-line protocol
1. Share the inputs
2. Run the Semi-honest protocol
3. Verify all ANDs gates
4. Reconstruct Output
3 bits per AND gate
The Protocol
On-line protocol
1. Share the inputs
2. Run the Semi-honest protocol
3. Verify all ANDs gates
4. Reconstruct Output
Output 𝑵 triples
3 bits per AND gate
The Protocol
On-line protocol
1. Share the inputs
2. Run the Semi-honest protocol
3. Verify all ANDs gates
4. Reconstruct Output
Pre-processing protocol
Output 𝑵 triples
3 bits per AND gate
The Protocol
On-line protocol
1. Share the inputs
2. Run the Semi-honest protocol
3. Verify all ANDs gates
4. Reconstruct Output
Pre-processing protocol
Output 𝑵 triples
?3 bits per AND gate
Generation of Random Multiplication Triples
• 𝑎 , [𝑏] are generated without any interaction!
• [𝑐] is computed using the semi-honest protocol
Generation of Random Multiplication Triples
• 𝑎 , [𝑏] are generated without any interaction!
• [𝑐] is computed using the semi-honest protocol
1 bit of communication!
Generation of Random Multiplication Triples
• 𝑎 , [𝑏] are generated without any interaction!
• [𝑐] is computed using the semi-honest protocol
How to verify that the triple is valid?
1 bit of communication!
Generation of Random Multiplication Triples
.
.
.
Generation of Random Multiplication Triples
.
.
.
Random permutation
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
If one of the opened triples is
incorrect, the honest parties will detect it and abort
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Verify the first triple in each bucket using 𝜷 − 𝟏
triples
.
.
.
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Verify the first triple in each bucket using 𝜷 − 𝟏
triples
.
.
.
If one of the buckets is “mixed”, the honest parties will detect it and
abort
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Verify the first triple in each bucket using 𝜷 − 𝟏
triples
.
.
.
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Verify the first triple in each bucket using 𝜷 − 𝟏
triples
.
.
.
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Verify the first triple in each bucket using 𝜷 − 𝟏
triples
.
.
.
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Verify the first triple in each bucket using 𝜷 − 𝟏
triples
.
.
.
Generation of Random Multiplication Triples
.
.
.
Random permutation
Open C triples
.
.
.
Split into N buckets of equal size
𝐵1
𝐵2
𝐵𝑁
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
𝛽 𝑡𝑟𝑖𝑝𝑙𝑒𝑠
Verify the first triple in each bucket using 𝜷 − 𝟏
triples
.
.
.
Overall: 𝑴+ 𝟑𝑪 + 𝟐𝑵 𝜷 − 𝟏 = 𝑵 𝟑𝜷 − 𝟐 + 𝟒𝑪 bits
The Balls & Buckets Game
𝑎𝑚𝑒(𝐴, 𝑁, 𝐵, 𝐶)
1. chooses 𝑁𝛽 + 𝐶 balls, where each ball can be bad or good
1.
Cost of the pre-processing: 𝑵 𝟑𝜷 − 𝟐 + 𝟐𝑪
The Balls & Buckets Game
𝐶𝐶), 𝐵𝐵𝑁𝑁, , 𝐴𝐴𝐺𝑎𝑚𝑒(𝑒(𝐴, 𝑁, 𝐵, 𝐶)
1. chooses 𝑁𝛽 + 𝐶 balls, where each ball can be bad or good
1.
Cost of the pre-processing: 𝑵 𝟑𝜷 − 𝟐 + 𝟐𝑪
The Balls & Buckets Game
𝐶𝐶 balls, where each ball can be bad or good
1. The adversary 𝐴 chooses 𝑁𝛽 + 𝐶 balls, where each ball can be bad or good
2. chooses 𝑁𝛽 + 𝐶 balls, where each ball can be bad or good
1.
Cost of the pre-processing: 𝑵 𝟑𝜷 − 𝟐 + 𝟐𝑪
The Balls & Buckets Game
𝐶𝐶 balls, where each ball can be bad or good
1. C balls are randomly chosen and opened.• If a bad ball was opened – the adversary loses
1.
Cost of the pre-processing: 𝑵 𝟑𝜷 − 𝟐 + 𝟐𝑪
The Balls & Buckets Game
𝐶𝐶 balls, where each ball can be bad or good
1. C balls are randomly chosen and opened.• If a bad ball was opened – the adversary loses
2. The balls are being randomly thrown into N buckets of size 𝛽• If all the buckets are fully good or fully bad, then the adversary wins
Cost of the pre-processing: 𝑵 𝟑𝜷 − 𝟐 + 𝟐𝑪
The Balls & Buckets Game
𝐶𝐶 balls, where each ball can be bad or good
1. C balls are randomly chosen and opened.• If a bad ball was opened – the adversary loses
2. The balls are being randomly thrown into N buckets of size 𝛽• If all the buckets are fully good or fully bad, then the adversary wins
Cost of the pre-processing: 𝑵 𝟑𝜷 − 𝟐 + 𝟐𝑪
The goal: Given a statistical parameter 𝝈 and number of triples 𝑵 to generate, find 𝜷, 𝑪 of minimal size such that:
𝑷𝒓 𝑨 𝒘𝒊𝒏𝒔 ≤ 𝟐−𝝈
The Balls & Buckets Game
The goal: Given a statistical parameter 𝝈 and number of triples 𝑵 to generate, find 𝜷, 𝑪 of minimal size such that:
𝑷𝒓 𝑨 𝒘𝒊𝒏𝒔 ≤ 𝟐−𝝈
Tiny OT Our Work
𝛽 4 3
𝐶 65,536 3
𝑀 = 𝑁𝛽 + 𝐶 4,259,840 3,154,731
𝑵 = 𝟐𝟐𝟎, 𝝈 = 𝟒𝟎
Summary & Efficiency
On-line protocol
1. Share the inputs
2. Run the Semi-honest protocol
3. Verify all ANDs gates
4. Reconstruct Output
Pre-processing protocol
1. Generate 𝑁𝛽 + 𝐶 triples
2. Open 𝐶 triples
3. Split into buckets and use 𝛽 − 1triples to verify one triple Output 𝑵 triples
Parameters: 𝑁 = 220, 𝛽 = 3, 𝐶 = 3
7 bits per AND gate
3 bits per AND gate
Efficiency Comparison
Communication (bits) Number of AES Computations
MRZ[15] 85N 3N
Our protocol 10N N/5
N = number of AND gates
Efficiency Comparison
Communication (bits) Number of AES Computations
MRZ[15] 85N 3N
Our protocol 10N N/5
Three-party with honest majority
at the cost of semi-honest Yao
N = number of AND gates
More Improvements & Implementation“Optimized Honest-Majority MPC for Malicious Adversaries –
Breaking the 1-Billion-Gate Barrier” (To appear in IEEE S&P 2017)
• Reduction of communication from 10 bits to 7 bits only!• This is achieved by better combinatorics that allows to use a bucket of size 2
(instead of 3)
• Cache-efficient shuffling
• Implementation• Basic implementation: 503,766,615 AND gates/sec
• With optimizations: 1,152,751,967 AND gates/sec